aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorChristophe JAILLET <christophe.jaillet@wanadoo.fr>2017-08-29 21:23:49 +0200
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2017-09-13 14:09:44 -0700
commit1875ed81c2b747877a6c868d6aa25738ca77d27d (patch)
tree51776c010592e57f3cc8cc6633c506e9228cfac8
parentf3584d55a8d8d0cff5a423e81162e069693c1914 (diff)
downloadlinux-linaro-stable-1875ed81c2b747877a6c868d6aa25738ca77d27d.tar.gz
driver core: bus: Fix a potential double free
commit 0f9b011d3321ca1079c7a46c18cb1956fbdb7bcb upstream. The .release function of driver_ktype is 'driver_release()'. This function frees the container_of this kobject. So, this memory must not be freed explicitly in the error handling path of 'bus_add_driver()'. Otherwise a double free will occur. Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--drivers/base/bus.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/base/bus.c b/drivers/base/bus.c
index 500592486e88..0346e46e2871 100644
--- a/drivers/base/bus.c
+++ b/drivers/base/bus.c
@@ -737,7 +737,7 @@ int bus_add_driver(struct device_driver *drv)
out_unregister:
kobject_put(&priv->kobj);
- kfree(drv->p);
+ /* drv->p is freed in driver_release() */
drv->p = NULL;
out_put_bus:
bus_put(bus);